Ministry of Industry and Information Technology, Measures for the Administration of Data Security in the Industry and Information Technology Sector (Trial Implementation) (Draft for Public Comments)

Issued: February 10, 2022

Main contents: A data processor in the industry and information technology sector shall submit its catalogue of important data and core data to the local competent industry and information technology department (industrial sector) or communications authority (telecommunications sector) or radio authority (radio sector) for the record. The content of such a record filing shall include but not be limited to data types, classification, size, processing purposes and methods, scope of use, responsible entity, external sharing, cross-border transfer, security protection measures and other basic information, but excluding the content of the data itself (Article 12).

Where laws or administrative regulations have requirements in respect of the storage in the mainland of the People's Republic of China of important data and core data collected and generated in the mainland of the People's Republic of China by a data processor in the industry and information technology sector, the same shall be stored in mainland China, and if the same genuinely needs to be provided to a party outside of mainland China, a security assessment of data to be transferred outside of mainland China shall be conducted in accordance with laws and regulations.